Prerequisites
- An account at admin.hackgate.io
- Your origin URL — the application you want to proxy (e.g.,
https://www.example.com) - A valid API token — see Authentication for instructions
1
Sign in to the Admin Center
Go to admin.hackgate.io and sign in with your organization account.Once signed in, you have access to your sites, analytics, and organization settings. You can also retrieve a Clerk JWT token from your session here for use in API requests.
2
Create a HackGATE site
Send a The response includes a
POST request to /api/sites with your origin URL as originName. HackGATE will provision a proxied subdomain for you.hackgatedName field with your new subdomain:Your site takes approximately 4 minutes to deploy after creation. You will receive an email notification when it is ready. The site status will change from
deploying to active once deployment completes.3
Share the HackGATEd URL with researchers
Once your site is active, share the
hackgatedName URL — for example, https://www-myorg.hackgate.io — with your researchers. This is the only URL they need.Your origin server remains private. All researcher traffic passes through the HackGATE proxy, which enforces your configured access controls, rate limits, and block rules.4
Monitor traffic in the dashboard
Open the Admin Center dashboard to view real-time traffic analytics, or query the analytics API directly. For example, to get the most active researchers on your site:The analytics endpoints return traffic timelines, most-active users, path discovery data, and WAF events. See the API reference for the full list of available endpoints.
Next steps
- Configure authentication — set up API keys for automated workflows
- Manage site access — configure hacker allowlists, rate limits, and scheduled testing
- Review WAF monitoring — understand what ModSecurity is flagging in your traffic